# EC-CUBE, an open-source e-commerce platform, contains an actively exploited cross-site…

Published: 2021-05-09 · Severity: high · Sectors: retail
Canonical: https://vorant.io/reports/6253989e-b9b2-4c8f-b002-f8f07b0796ff/ec-cube-an-open-source-e-commerce-platform-contains-an-actively-exploited-cross

> EC-CUBE, an open-source e-commerce platform, contains an actively exploited cross-site scripting vulnerability allowing attackers to execute scripts in administrator browsers.

Japan's IPA has issued an advisory regarding a cross-site scripting (XSS) vulnerability in EC-CUBE, an open-source shopping site construction system developed by EC-CUBE Co., Ltd. The vulnerability exists in the administrative interface and allows attackers to inject malicious scripts through specific input fields. When administrators perform certain operations, arbitrary scripts can be executed in their browsers.

The vulnerability has a CVSS v3 score of 7.1 (high severity) and CVSS v2 score of 6.8. According to the developer, active exploitation of this vulnerability has been confirmed in the wild, making immediate patching critical. The attack vector requires an attacker to input malicious scripts into specific fields on EC sites created with the vulnerable platform, which then execute when site administrators interact with the affected functionality.

The developer has released updated versions and hotfix patches to address this vulnerability. Organizations running EC-CUBE are urged to apply updates or patches as soon as possible given the confirmed exploitation activity. The advisory was published by IPA's Security Center on May 10, 2021.

## Mentioned in this report

- Vulnerabilities: CVE-2021-20717

## Detection guidance (public sample)

### Possible XSS Payload Injection Attempt in Web Request Parameters (EC-CUBE Admin)

ATT&CK: T1059.007

Detects HTTP requests containing common script-injection patterns in URI query strings or POST body fields, consistent with stored XSS attempts against EC-CUBE admin input fields. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible XSS Payload Injection Attempt in Web Request Parameters
id: 95edbbeb-9afd-56ab-8961-5525d662e91a
status: experimental
description: 'Detects web requests where the URI query string or request body contains

  script-tag or event-handler based XSS payload patterns. This behaviour

  matches attempts to store malicious JavaScript in application input fields

  (e.g. product/administrative fields in EC-CUBE) that later execute in an

  administrator''s browser when the record is viewed or edited.

  '
references:
- https://www.ipa.go.jp/security/
author: Vorant
tags:
- attack.t1059.007
- attack.t1189
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - onmouseover=
    - document.cookie
  filter_common_false:
    cs-uri-query|contains:
    - utm_source
  condition: selection and not filter_common_false
falsepositives:
- Legitimate product descriptions or CMS content that legitimately contains the string
  "script" as part of marketing copy
- Security scanners or penetration testing tools probing the application for XSS as
  part of authorized testing
- Web analytics or tag-manager scripts intentionally embedding inline JavaScript in
  query parameters
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210510-jvn.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6253989e-b9b2-4c8f-b002-f8f07b0796ff/ec-cube-an-open-source-e-commerce-platform-contains-an-actively-exploited-cross.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup